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What is claimed is : 



1. A method of processing and storing data in a 
computer system including processor circuitry, and a data 
storage device Athe method comprising the steps of: 

storing, first and second sets of records on the 
data storage devices, the first and second sets of records 
being of different data resolutions and corresponding to 
overlapping periods o\ time; 

operating th& processor circuitry to receive 
data collected over a period of time; and 

operating the processor circuitry to update at 
least one record in each ofVbhe stored first and second 
sets of records with the received data. 



2. The method oS claim 1, 
wherein wie first and second sets of records 

are stored in separate first-in, first-out data 
■structures on the dayanstorage device; and 

wherein thye )step of operating the processor 
circuitry to update lax Yeast one record in each of the 
stored first and second ^ets of records , includes the 
step of replacing a previous record included in each of 
the first and second data structures, 

3. The method of claim *jl 9 furtfc^er comprising the step 

/ 

allocating fixed amounts of storage space on 
the data storage device for srtoring each one of the first 
and second first-in, first-out data structures used to 
store the first and second/ sets of records. 
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4. The method of claim wherei/n the first set of 

A / 

records include hourly records a ad the second set of 
records includes daily records. 

\ 

5. The method of claim fi, farther comprising the step 
of: 

periodically colL^cting network traffic data; 
storing the collected network traffic data in a 
buffer; and 

operating the /processor circuitry to retrieve 
network traffic data fyom the buffer, the retrieved 
network traffic data being received by the processor 

/ ^ 

The method of /:1a im 5, 

wherein X;he network traffic data stored in the 
buffer includes time stamp information indicating the 
period of time which the network traffic data was 
collected; and 

wherein the step of operating the processor 
circuitry to yfpdate at least one record in each of the 
stored first/and second sets of records includes the step 
of: 

Examining at least one time stamp included in 
the buffered network traffic data. 



7. The method of claim 5, wherein the collected network 

raffic data includes /byte and packet count information 
associated with each pf a plurality of monitored 
conversations between devices included in the computer 
system, the step of operating the processor circuitry to 



* 
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update at least one record in each of the stored first 
and second sets of rec/rds including the steps of: 

updating a Record corresponding to a first 
conversation in the kxrst set of records; and 

updating /a record corresponding to the first 
conversation the srecond set of records. 



8. The method of claim/5, 

wherein the processor circuitry includes first 
and second central processing units, and 

wherein the /step of operating the processor 
circuitry to update 3ft least one record in each of the 
stored first and sec6nd sets of records includes the step 
of operating the first processor to update the first set 
of records while operating the second processor to update 
the second set of records. 




9. The method af claim 1, 

wherein the processo r c ircuitry includes first 
and second central processing units, and 

wherein the step of operating the processor 
circuitry to update at least one record in each of the 
stored first and second sets of records includes the step 
of operating /the first processor to update the first set 
of records wnile operating the second processor to update 
the second set of records. 



10. The method of claim 5, wherein the computer system 
further includes a display device, the method further 
comprising the step of: 
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displaying data corresponding to overlapping 
periods of time at differe/t resolutions on the display 
device. 



11. 

of: 



The method ^of claij 



urther. comprising the step 




allocating storajg^^space for storing the first 
and second sets of r/cords in^irst and second first-in,. 
first-out data structures, respectively. 



12. -Va method W collecting and processing network 
traffic data,- comprising the' steps of : . 

periodically collecting network traffic "data 
from a data probe, 

generating a database of network traffic 
information from th® collected network traffic data, the 
database comprising a plurality of network traffic data 
sets of diff ering , degrees of data resolution 
corresponding . to overlapping network traffic : tlme 
periods. 



13. The method of claim 12^, wherein the differing 
degrees of resolution correspond to measurement time 
periods of different duration. 




14. The method of claj/fri 12, 

wherein the /collected network traffic data 
includes a plurality ybf traffic data counter values; and 
wherein earch traffic data counter value in the 
collected network traffic data includes information 
corresponding to an individual monitored conversation, 
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the step of generating a database including the step of 
generating from the inf ormat/o/f gn each different 
monitored conversation, a d/f r^renJXrecord in each set of 
the plurality of network t/affic data sets 

15. The method dvf claim 14, further comprising the step 
of storing each ofVthe plurality of network traffic data 
sets in a dif f erent \f irst-in, first-out data structure. 

16. The method of cla\5ft^l5, wherein a limited amount of 
data storage space is/u^^ fo^i: each of the different 
first-in, first out djata.\itructures, the method further 
comprising the step o\ 

overwriting the dldest data records in the 
first-in, first-out data structure used to store one' of 
the network traffic data sets\ when the limited amount of 
data storage space used for sa\d first-in, first-out data 
structure is filled with records 



■17"; . A system fosf monitoring network traffic data, 
cpmprising : 

a plurality of network traffic data probes for 
collecting network tVaffic information; 

processor cnNrcuitry coupled to the network 
traffic probes for receiving data therefrom; and 

a data storageNdevice for storing a network 
traffic database generatecKby the processor circuitry 
using data collected by theVietwork traffic data probes, 
the data storage device including: 
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11 a plurality of data structures, each one of the 

12 plurality of data structures including network traffic 

13 data: / 

14 a) stored at a different resolution than the 

15 resolution at which/network jtraffic data is stored 

16 in the other ones/of the Eflurality of data 

17 structures; and / / 

18 b) corresponding t/o a period of time which 

19 overlaps the yperiod of t'ime— f6r which network 

20 traffic datar is stored in the other ones of the 

21 plurality /f data structures. 

1 18. The system Vfis claim 17, wherein each of the 

2 plurality of datyaWtructures is a first-in, first-out 

3 data structure. ^\ 

j '1 

& 1 19. The system pf claim^^l/8, wherein each one of the 

2 plurality of daJ:ac structures includes a plurality of data 

3 records, each yaata recprd corresponding to a monitored 

4 network conversation. 

/ l l 

&s 1 20. The system of oaaim^^ , wherein data records are 

2 arranged within eadn individual data structure as a 

3 function of the time th& conversation to which the record 

4 corresponds was mpnit^red. / 

1 21. The system bf claim 20, wherein records which were 

2 monitored during the same time interval are grouped 

3 together withim each individual data structure. 



22. The system of claim 21, furtmer comprising; 

means for modifying at least one network 
traffic data record included ip each one of the plurality 
of data structures to reflect/collected information about 
an individual network conversation. 

23. The system of claim 18, further comprising: 

K I 

means for modifying at least one network 
traffic data record incluraed in each one of the plurality 
of data structures to reflect collected information about 
an individual network conversation . 

L '2 

24. The system of cLaiir^p/8, wherein the processor 
circuitry includes a/ plurality of separate central 
processing units wh/ch operate in parallel. 



25. The system off claim 24, wherein each one of the 
plurality of . data/ structure^yncludes a plurality of data 
records, each dat/a record/corresppnding to a monitored 
network conversation. ^ 



26. The system/of claim 24, wherein data records are 
arranged withini each individual data structure as a 
function of the time the conversation to which the record 
corresponds was monitored. 



27. The system of claim 26, wherein records which were 
monitored durang the same time interval are grouped 
together witnin each individual data structure. 
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28. The system of claim/27, further comprising: 

means for modifying at least one network 
traffic data record included in each one of the plurality 
of data structures to/ref lect collected information about 
an individual network coni/erLation . 




29. The system of I claim 24, further comprising: 

means t£r modifying at least one network 
traffic data record included in each one of the plurality 
of data structures to reflect collected information about 
an individual network conversation. 




